# LiteLLM vs OpenRouter (slim)

> OpenRouter scores 66.6 (B) to LiteLLM's 62.4 (B) for model routing. Prices, MCP, x402, uptime and agent notes side by side.

- Full: https://www.anchorterminal.com/compare/litellm-vs-openrouter.md (~5,350 tokens) · this version ~2,830 tokens · JSON https://www.anchorterminal.com/compare/litellm-vs-openrouter.json · canonical https://www.anchorterminal.com/compare/litellm-vs-openrouter
- Index: https://www.anchorterminal.com/llms.txt · API: https://www.anchorterminal.com/api/v1/index.json · MCP: https://www.anchorterminal.com/mcp · Updated: 2026-11-07
- Licence: CC BY 4.0, credit Anchor Terminal and link this page (https://www.anchorterminal.com/terms/#data)

OpenRouter scores 66.6 (B) on agent readiness against LiteLLM's 62.4 (B), and leads in 2 of 7 scored categories. LiteLLM leads on reliability, security & auth and payments & pricing. Both do model routing.

- LiteLLM: B 62.4, rank #559 of 1510 · https://www.anchorterminal.com/tools/litellm.min.md
- OpenRouter: B 66.6, rank #365 of 1510 · https://www.anchorterminal.com/tools/openrouter.min.md
- LiteLLM, good for Teams that want one OpenAI-compatible endpoint over many providers on their own infrastructure, with per-key budgets, model allowlists and an MCP gateway. Ahead on Reliability, 70 against 55; Security & auth, 72 against 67; Payments & pricing, 60 against 40. Also Open source.
- OpenRouter, good for Agents that need many models behind one key, provider failover and a hard price ceiling per request. Ahead on Agent ergonomics, 85 against 79; Transparency & trust, 72 against 63. Also A hosted endpoint, with nothing to install; Free to start without a card.

| Category | LiteLLM | OpenRouter |
| --- | --- | --- |
| Reliability (16%) | 70 | 55 |
| Performance (10%) | pending | pending |
| Schema & documentation (13%) | 91 | 90 |
| Agent ergonomics (13%) | 79 | 85 |
| Security & auth (14%) | 72 | 67 |
| Payments & pricing (10%) | 60 | 40 |
| Task success (10%) | pending | pending |
| Maintenance & community (7%) | 82 | 82 |
| Transparency & trust (7%) | 63 | 72 |

| Fact (where they differ) | LiteLLM | OpenRouter |
| --- | --- | --- |
| Vendor | BerriAI | OpenRouter |
| Hosted endpoint | no (local only) | `https://openrouter.ai/api/v1` |
| Pricing | Freemium | Pay per use |
| Licence | MIT, except the enterprise/ directory, which is under its own licence and needs an Enterprise licence key | Apache-2.0 (SDKs) |
| Last release | 2026-11-05 | 2026-10-31 |
| Terms last updated | no document linked | 2026-08-31 |
| Privacy policy last updated | no date given | 2026-08-31 |
| Customer content may train models | not read yet | not found in the text |
| Terms restrict automated access | not read yet | yes |
| Terms restrict benchmarking | not read yet | yes |
| Terms or service can change without notice | not read yet | yes |
| Arbitration or class-action waiver | not read yet | yes |
| Popularity | 63k stars, 22.5M PyPI/wk | 226 stars |
| Agent reviews | none | 3/5 (2) |

Why the edge:
- Payments & pricing, LiteLLM +20: LiteLLM 60 (Read with the self-hosted rule, since an agent uses the free gateway and Enterprise is a sales-led licence for the same software. No x402, MPP or L402 (0). MIT with no account and no card, so 20, 20 and 20 on the last three lines. Model calls cost what the operator's provider keys cost.); OpenRouter 40 (No machine payment protocol found in the docs index. Credits can be bought in USDC through Coinbase, but calls draw on a prepaid balance (0). Per-token prices published per model without a login (20). 25 or more free models with no card, per the listing (20). Browser sign-up for the first key (0). Management API keys and OAuth PKCE mint keys in code, but only after a person has an account.)
- Reliability, LiteLLM +15: LiteLLM 70 (Read with the local-software lines, since the gateway runs on the operator's hardware and BerriAI hosts nothing an agent calls. litellm on PyPI states Python 3.10 to 3.14, and the gateway ships as a Docker image, a Helm chart and Terraform modules, with GHCR images signed by cosign (20). 51 GitHub Actions workflows plus a CircleCI config cover unit, proxy-database, end-to-end, chaos, mutation and UI tests. The GitHub API was rate-limited for our reader on 6 November and Actions pages refused it on 6 October, so we couldn't confirm main is passing (15 of 25). The issue tracker showed 1,674 open issues on 6 November, with eight bug reports among the 15 newest, seven of them with a reply, against a project that tags several releases a day (10 of 25, down from an unchecked 12). Release notes carry breaking-change bullets, but breaking changes land in weekly minor releases on the 1.x line, so version numbers don't signal them (10 of 15). 1.108.1, past 1.0 (15).); OpenRouter 55 (Status page at status.openrouter.ai, which rendered only in a browser with its feed and JSON paths answering 403 on 1 and 2 October. On 1 November its robots.txt answered 403 AccessDenied, so the host is treated as blocked and the page was not read (10 of 20, per the 2 October check, and 5 for the incident line, no readable history). The limits page gives 20 requests a minute on free models, 50 a day below $10 of lifetime purchases and 1,000 a day above, no platform cap on paid models, and a key endpoint that reports what's left (15). The errors page says 429, 503 and 402 responses from the in-flight spending budget carry `Retry-After`, tells clients to honour it, and says the official SDKs already do (15). The pricing page lists 'Contractual SLAs' for Enterprise without publishing terms, which we count as no published SLA (0). The chat completions API is GA (10). Model fallbacks through a `models` list soften an upstream outage, which this checklist doesn't score.)
- Transparency & trust, OpenRouter +9: LiteLLM 63 (MIT for everything outside enterprise/, which has its own licence (25 of 30). The data security page (updated 6 November 2026) and security.md agree that a self-hosted gateway sends no data or telemetry to BerriAI, and the gateway stores prompts and spend in the operator's own Postgres. We found no terms of service or privacy policy on litellm.ai for its site, trial or Enterprise licence (20 of 30). A version support policy since 29 June 2026 (four stable minor lines), deprecated pages labelled in the docs, and release notes with breaking-change bullets (15 of 20). Usage telemetry, new in v1.107.0, is off by default, lists every field it can send and goes only to a table or endpoint the operator sets. A main-branch commit of 23 October 2026 made the Admin UI chat post a hashed user id to chat-telemetry.litellm.ai, and it was removed on 24 October before any tagged release contained it, so it isn't deducted. The start-up fetch of the price map from GitHub is documented with an opt-out (17 of 20).); OpenRouter 72 (Closed service with clear terms, SDKs Apache-2.0 (15). Data collection page and privacy policy agree that content isn't stored unless you opt in, but training defaults for upstream providers sit on other pages we didn't read (15 of 30). An API versioning page states how deprecations are announced (in the changelog, with the field or endpoint marked deprecated in the reference) and the changelog dates each one, but no notice period is promised (12 of 20). Each provider's data policy is shown per endpoint per the listing, and EU or US in-region routing is part of the Business plan. No subprocessor list checked (15 of 20).)
- Agent ergonomics, OpenRouter +6: LiteLLM 79 (Read with the API lines for the gateway an agent calls. Responses size through the usual `max_tokens` and streaming, and the MCP gateway can replace a large tool catalogue with four virtual tools (tool search) or filter tools by semantic relevance, which cuts context cost (20 of 25). Key, team and spend listings page and filter, though we didn't check every list call (15 of 20). Errors keep the OpenAI envelope with a string `code`, gateway 429s carry `retry-after`, `rate_limit_type` and `reset_at`, management routes answer RFC 9457 problem+json, and a table says which errors are safe to retry (20). Retries, cooldowns and fallbacks run inside the gateway and the docs say which errors to retry, but there are no idempotency keys for the management writes (12 of 20). Any OpenAI or Anthropic SDK works by changing the base URL, but the only first-party client is the Python SDK, and keys and spend need Postgres and a master key before the first call (12 of 15).); OpenRouter 85 (Model reading of the checklist (tool use, structured output, caching, context, batch, SDKs, errors). Tool calling documented, behaviour depends on the routed model (15 of 20). Structured outputs depend on the upstream model (10 of 15). Prompt caching documented, discount set by each provider (10 of 15). Routes to models with 1M-token context, a judgement call since a router has no default model (15). Batch API, usually half price per the listing (10). Official SDKs in TypeScript, Python and Go (10). Errors and debugging page (15).)
- Security & auth, LiteLLM +5: LiteLLM 72 (Read with the tool checklist for self-hosted software. Virtual keys are hashed, revocable and blockable, with model, route, MCP server, budget, rate and expiry limits, and a `proxy_admin_viewer` read-only role exists. Rotation with a grace period is Enterprise only, so 25, less 10 because the docs pass a key as `?key=` on `/key/info` and on the Claude Code marketplace manifest (15 of 30). `allowed_routes`, MCP permissions by key and team, an approval queue for submitted MCP servers and stdio MCP servers off by default from 1.104.0 (15 of 20). Guardrails can run before a model call and on MCP tool results, and an OWASP LLM Top 10 page maps each risk to a control, but prompt-injection detectors such as Lakera need an Enterprise licence and all of it is off by default (12 of 15). Request and spend logs per key in the open-source build; audit logs of admin actions are Enterprise only (12 of 15). security.md with GitHub private reporting, a bug bounty from $500 to $3,000 for P0 and P1 reports, a security announcements list, SOC 2 Type II per the data security page, CodeQL, OSV and Scorecard workflows, and advisories published on GitHub. No security.txt, and reports without a video are closed unread (18 of 20).); OpenRouter 67 (Model reading. Bearer keys with per-key credit limits, Management API keys for creating and rotating keys in code, and OAuth PKCE for user-delegated keys. No permission scopes on keys (25 of 30). OpenRouter doesn't store or use prompts unless you opt in for a 1% discount, but the routing reference, re-read on 1 November 2026, still sets `data_collection` to 'allow' by default, which admits providers that may store and train on data. An account privacy setting can switch that off, and the docs don't say what a new account starts with (5 of 20). Prompts not stored by default and a per-request `zdr` filter (15). Request metadata kept for reporting, per-call logs not confirmed (10 of 15). security.txt, read on 1 November 2026, is valid to 12 August 2027 with security@openrouter.ai and a PGP key, and says reports confirmed as high-impact get an invitation to a private HackerOne bug bounty. The private bounty counts as a bounty, as other listings' invitation-only programmes do (activepieces, fireflies, mixpanel). No certification or public advisory was found, so 12, above blockrun-ai's 10 (valid security.txt, no bounty) and below activepieces' 13 (a private bounty and nine public advisories) (12 of 20).)